> 82% of the top 100 sites use eval() (in 2011)

WAT?

prolly jQuery or something uses it somewhere.

The example that James Mickens gave:

Instead of

f[x]

you write

eval("f." + x)

because you don't know bracket notation.

@RobertHarvey that deserves a facedesk more than anything ever

maybe stilldrinking.org/programming-sucks is less of a hyperbole than I thought

to be fair, I didn't know brackets did that in javascript. That's vile.

I imagine someone could develop a toolkit that scans for exploitable usage of eval, and use sophisticated engine to find an actual way of exploiting it ?

but first you would need a javascript parser :/

@Telastyn Javascript arrays are actually object literals. Except they're not. Quite.

and lol, same use of eval :p

yeh.

Since you can arbitrarily add members to an object in Javascript, arrays are implemented by simply adding members. When you want to index a particular element in the array, Javascript converts your numeric index to a string, and accesses the member corresponding to that string.

So they're not really arrays. They're more like hash maps, and have the same performance characteristics as a sparse array.

It's a weird language, in some ways. And a brilliant language in others.

speaking of weird language

obj = eval(uneval(o)) stackoverflow.com/questions/122102/…

I was trying to come up with an example of a case where you have a function that takes a function as a parameter, which in turn takes (another?) function as a parameter.

For people who have implemented a toy scripting language runtime (without knowing any language theory! no nothing!) javascript's design should be plain obvious.

semi-afk, steak.

Mmm... Steak.

Medium rare?

Of course, I did not just crawl out of a cave.